CVE-2019-10911: High severity symfony vulnerability

Q: What is CVE-2019-10911?

CVE-2019-10911 is a vulnerability in Symfony that allows an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled.

Q: Which versions of Symfony are affected by CVE-2019-10911?

Symfony versions 2.7.0 up to 2.7.51, 2.8.0 up to 2.8.50, 3.0.0 up to 3.4.26, 4.0.0 up to 4.1.12, and 4.2.0 up to 4.2.7 are affected by CVE-2019-10911.

Q: How can an attacker exploit CVE-2019-10911?

An attacker can exploit CVE-2019-10911 by manipulating the remember me cookie hash to authenticate as a privileged user.

Q: Is there a fix for CVE-2019-10911?

Yes, the recommended fix for CVE-2019-10911 is to upgrade Symfony to version 3.4.26, 4.1.12, or 4.2.7.

Q: Where can I find more information about CVE-2019-10911?

You can find more information about CVE-2019-10911 on the Symfony website at [insert link].

Published Apr 16, 2019

Updated

CVE-2019-10911: Add a separator in the remember me cookie hash

Other sources

In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, a vulnerability would allow an attacker to authenticate as a privileged user on sites with user registration and remember me login functionality enabled. This is related to symfony/security.

Affected Software

11 affected componentsFixes available

composer/symfony/symfony>=2.7.0, <2.7.51, >=2.8.0, <2.8.50, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <3.4.26, >=4.0.0, <4.1.0, >=4.1.0, <4.1.12, >=4.2.0, <4.2.7

composer/symfony/security>=2.7.0, <2.7.51, >=2.8.0, <2.8.50, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <3.4.26, >=4.0.0, <4.1.0, >=4.1.0, <4.1.12, >=4.2.0, <4.2.7

composer/symfony/security-http>=2.7.0, <2.7.51, >=2.8.0, <2.8.50, >=3.0.0, <3.1.0, >=3.1.0, <3.2.0, >=3.2.0, <3.3.0, >=3.3.0, <3.4.0, >=3.4.0, <3.4.26, >=4.0.0, <4.1.0, >=4.1.0, <4.1.12, >=4.2.0, <4.2.7

debian/symfony

3.4.22+dfsg-2+deb10u13.4.22+dfsg-2+deb10u24.4.19+dfsg-2+deb11u35.4.23+dfsg-15.4.29+dfsg-15.4.30+dfsg-1

SensioLabs Symfony>=2.7.0<2.7.51

SensioLabs Symfony>=2.8.0<2.8.50

SensioLabs Symfony>=3.4.0<3.4.26

SensioLabs Symfony>=4.1.0<4.1.12

SensioLabs Symfony>=4.2.0<4.2.7

Drupal Drupal>=8.5.0<8.5.15

Drupal Drupal>=8.6.0<8.6.15

Remediation

Patch Available

https://github.com/symfony/symfony/commit/a29ce2817cf43bb1850cf6af114004ac26c7a081

Event History

Apr 16, 2019

Advisory Published

10:54 AM

May 16, 2019

CVE Published

via MITRE·09:29 PM

Data Sourced

via MITRE·09:29 PM

Description

Frequently Asked Questions

What is CVE-2019-10911?